A hacker group linked to Israel, known as “Predatory Sparrow” or “Gonjeshke Darande,” executed an audacious cyberattack on Nobitex, Iran’s largest cryptocurrency exchange. The attack, which drained over $90 million in digital assets, has sent shockwaves through the global cryptocurrency community and escalated tensions in the ongoing Israel-Iran cyber conflict. This sophisticated operation not only targeted Iran’s financial infrastructure but also carried a sharp political message aimed at the Islamic Republic’s leadership.
According to blockchain analytics firms Elliptic and Chainalysis, the hackers siphoned off a staggering array of cryptocurrencies, including Bitcoin, Ethereum, Dogecoin, and other digital assets, from Nobitex’s hot wallets, online storage systems vulnerable to cyber intrusions. The stolen funds, estimated at over $90 million, were not transferred to wallets for personal gain but instead sent to so-called “vanity addresses.” These blockchain addresses contained embedded anti-government messages targeting Iran’s Islamic Revolutionary Guard Corps (IRGC), a powerful military and political entity in the country.
The use of vanity addresses, which are computationally expensive to generate and typically serve no practical purpose for thieves, suggests the hackers’ intent was not financial enrichment but disruption and symbolic protest. By rendering the funds inaccessible, the hackers effectively “burned” the assets, dealing a significant blow to Nobitex and its users. Predatory Sparrow’s public statement following the attack accused Nobitex of facilitating sanctions evasion and financing terrorist activities through cryptocurrency transactions, aligning the operation with broader geopolitical objectives.
Read also:
- Trump’s camp split over US joining Israel in attacking Iran
- Iran’s Army faces crisis as reports of abandoned positions surface amid escalating conflict
- Iran State Broadcaster resumes transmission hours after Israeli Airstrike
This cyberattack is the latest in a series of high-profile operations attributed to Predatory Sparrow, a group known for its sophisticated and politically motivated attacks on Iranian infrastructure. Just a day earlier, on June 17, 2025, the same group claimed responsibility for a cyberattack on Iran’s state-owned Bank Sepah, disrupting its operations and further straining Iran’s financial systems. These incidents occur against the backdrop of escalating tensions between Israel and Iran, fueled by regional conflicts, nuclear disputes, and mutual accusations of sponsoring terrorism.
Predatory Sparrow has a history of targeting critical Iranian infrastructure, including fuel distribution systems, steel factories, and now financial institutions. Their operations are often characterized by precision and a clear intent to expose vulnerabilities in Iran’s state-controlled systems while sending a message of defiance. The Nobitex hack, in particular, underscores the growing role of cryptocurrency in geopolitical conflicts, as digital assets become both a tool for bypassing sanctions and a target for adversaries seeking to disrupt illicit financial flows.
Nobitex, a major player in Iran’s cryptocurrency market, quickly acknowledged the breach and suspended all operations to assess the damage. In a statement, the exchange assured users that it would compensate those affected by leveraging its insurance fund, though questions remain about the feasibility of covering such a significant loss. The attack has exposed vulnerabilities in Iran’s cryptocurrency ecosystem, which has grown in importance as the country seeks alternatives to traditional financial systems amid stringent international sanctions.
The broader implications for Iran’s economy are significant. Cryptocurrencies like Bitcoin have been a lifeline for Iranians navigating hyperinflation and restricted access to global banking systems. The loss of such a large volume of digital assets could undermine public confidence in local exchanges and further strain Iran’s financial resilience.
This recent cyberattack on Nobitex by Predatory Sparrow marks a significant escalation in the Israel-Iran cyber conflict, blending financial disruption with political messaging. By draining over $90 million in cryptocurrencies and redirecting them to inaccessible addresses, the hackers have struck a blow against Iran’s financial infrastructure while signaling their intent to challenge the IRGC’s influence. As Nobitex scrambles to recover and Iran weighs its response, the incident highlights the growing intersection of cryptocurrency, cybersecurity, and geopolitics. In a world where digital assets are both a shield and a target, the Nobitex hack may be a harbinger of more such attacks to come.